/** * loop-render — the schema-driven GENERATOR of loop-designer (ADR-002): `loop-plan/1` plan → * ONE region-delimited, self-contained Workflow script + a sidecar `.plan.json` (the plan is * written BEFORE and independently of the script — FR-4.1: the oracle diff compares against an * artifact the renderer has not touched). * * Region contract (architecture §3.1): * BLOB — verbatim bytes from the blob registry; replaced wholesale on re-render (INV-10). * GENERATED — derived from the plan; replaced wholesale (lint rule `plan-binding`). * USER — the ONLY hand-editable regions; preserved BYTE-FOR-BYTE on re-render (INV-11). * * The exec fingerprint (FR-1.6 / AM-10) hashes ALL FOUR axes independently-sensitively: * topology (structural plan shape) + prompts (per-step prompt text ONLY) + models (per-step * declared model ONLY) + tools (the declared blob set with content hashes). The axis inputs are * NON-REDUNDANT by construction (QE round-2 G2): no axis embeds rendered text that would let it * subsume another. Changing ANY ONE axis alone changes the fingerprint, so a resume against a * stale fingerprint is REFUSED (the generated resume-guard call site supplies this hash where the * legacy feature-adr call site supplies inputHash alone — physical duplication only, no canonical- * file change). * * Merge is propose-never-clobber (§3.2): a target with no markers is refused (write * `